CVE-2026-45016: EGroupware Vulnerable to Local File Inclusion via file:// URI in Mail Compose

July 7, 2026

The function processes image URLs embedded in an HTML email body without validating or restricting URI schemes. The check !str_starts_with($myUrl, 'http') evaluates to true for file:// URIs, causing file_get_contents($basedir . urldecode($myUrl)) to read arbitrary files from the server filesystem and embed them as inline MIME attachments in outgoing email.

str_starts_with(‘file:///etc/passwd’, ‘http’) → false !false → true

// api/src/Mail.php
foreach($images[2] as $i => $url)
{
//$isData = false;
$basedir = $data = '';
$needTempFile = true;
$attachmentData = ['name' => '', 'type' => '', 'file' => '', 'tmp_name' => ''];
try
{
// do not change urls for absolute images (thanks to corvuscorax)
if (!str_starts_with($url, 'data:'))
{
$attachmentData['name'] = basename($url); // need to resolve all sort of url
if (($directory = dirname($url)) == '.') $directory = '';
$ext = pathinfo($attachmentData['name'], PATHINFO_EXTENSION);
$attachmentData['type'] = MimeMagic::ext2mime($ext);
if ( strlen($directory) > 1 && !str_ends_with($directory, '/')) { $directory .= '/'; }
..
...
....
// processURL2InlineImages function
if ( $myUrl[0]!='/' && strlen($basedir) > 1 && !str_ends_with($basedir, '/')) { $basedir .= '/'; }
if ($needTempFile && empty($attachment) && !str_starts_with($myUrl, "http"))
{
try {
$data = file_get_contents($basedir.urldecode($myUrl));
}
catch (\Throwable $e) {
_egw_log_exception($e);
}
}
}
if (str_starts_with($url, 'data:'))

References

Code Behaviors & Features

Detect and mitigate CVE-2026-45016 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →